DropPicker
Career Library

Privacy Notice – Supplement to the Personal Information Collection Statement (“PICS”) of DropPicker for Students and New Graduates 

This privacy notice supplements the PICS and applies to you if and to the extent that the General Data Protection Regulation of the European Union (“GDPR”) is applicable and relevant.

It is important that you read and understand this privacy notice, together with any other privacy notices/PICSs that you are provided on specific occasions or matters. 

The GDPR can be accessed at https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=1532348683434&uri=CELEX:02016R0679-20160504. 

Introduction 

The University of Hong Kong (“University”) is committed to protecting the privacy and security of your personal data (“personal data”). This privacy notice further explains how the University collects, uses, shares, handles and stores your personal data, and outlines your rights in relation to the personal data that we process in DropPicker.

The University is the Data Controller for your personal data. 

The GDPR Focal Point for this privacy notice is the Careers and Placement Section, Centre of Development and Resources for Students, MW303, Meng Wah Complex, The University of Hong Kong, Pokfulam, Hong Kong (email: DropPicker@cedars.hku.hk).  

Personal Data Collected/To Be Collected 

The University may collect, hold and process personal data of you including personal and contact details, education and training records, application letter, resume and application records. 

Personal data and special categories of personal data of you held by the University are collected directly from you during your studies at the University and through your registration at DropPicker. When your personal data is collected from a third party or source, you will be informed if it is required by the GDPR. 

Purposes of Collection 

The University collects, holds and processes the personal data and special categories of personal data of you in order to provide services through DropPicker. The personal data may also be disclosed to the administrators for user and content management purposes. Without the personal data, the University may not be able and provide the services to you, or meet its statutory and other obligations. Information is utilised by various offices/work units of the University as is necessary and proportionate for our operational purposes (including the performance of academic, education, research and administrative functions). 

Use of Data 

The University will use personal data (including special categories of personal data) to provide services through DropPicker, to communicate with you in relation to DropPicker usage and support, and to meet statutory or other obligations. 

We may also use your personal data for other purposes, for example: to undertake statistical analyses and reporting, surveys, or other forms of research into academic prediction and progression, trends and market analyses, to carry out compliance audits, to promote and enhance services. 

In some cases, we may undertake automated decision-making using personal data in the processes. When this has a negative impact on you, we will ensure this decision is checked by a member of staff before processing. If necessary, we may also provide more information to you according to the GDPR. 

Provision of personal data is voluntary. However, failure to provide relevant information when requested, or request from you to delete some or all of your data, may render the University unable to provide services or to meet statutory obligations.  

Accessing and Updating the Personal Data 

You are able to access and update personal data by contacting the Careers and Placement Section, Centre of Development and Resources for Students, MW303, Meng Wah Complex, The University of Hong Kong, Pokfulam, Hong Kong (email: DropPicker@cedars.hku.hk). Please advise us promptly of any changes to your details. 

If you have any questions about the personal data we hold, please contact the above GDPR Focal Point in the first instance. 

Legal Bases for Processing the Personal Data 

The legal bases for processing include: 

(a) pursuing legitimate interests by the University or by a third party for purposes set out in this privacy notice; 

(b) consent from you for processing certain kinds of personal data – you have the right to withdraw your consent at any time; 

(c) performance of a contract under which the University provides facilities and services to you or taking steps at the request of you prior to entering into a contract; 

(d) processing activities under a legal obligation; 

(e) protecting the vital interests of you or another party; and/or 

(f) performance of a task carried out in the public interest or in the exercise of official authority (for example, collecting or disclosing information in order to meet regulatory or statutory requirements). 

Where special categories of personal data are processed, the legal bases for doing so will be those provided under the GDPR. 

Sharing Personal Data with Third Parties 

For purposes referred to in this privacy notice, we may share your personal data with certain third parties. You are given the opportunity to opt out of some data sharing arrangements, but we encourage you to think carefully about the impact of doing so. Where an opt-out is not in place, we will disclose relevant personal data to third parties. 

Transfer of Personal Data outside of the European Economic Area (“EEA”) and/or to International Organisations 

If we need to transfer your personal data outside the EEA and/or to international organisations, any such transfer will comply with the requirements of the GDPR. If necessary, you may be informed and your consent may be obtained. 

Retention of Personal Data 

Subject to any statutory requirements, data will be retained by the University for periods required to meet the purposes and directly related purposes of the collection or creation of such data (e.g. to enable long-term and longitudinal research, prediction of academic success, long- and short-term trends, and market analyses) to meet annual reporting and statutory requirements, and/or for public interest (including historical interest). 

Rights of Data Subjects 

Data subjects have the following rights under the GDPR: 

• The right to be informed about which personal data is collected and how it will be used; 
• The right to request access to personal data held by the University; 
• The right to have incomplete or inaccurate personal data rectified; 
• The right to have personal data removed or deleted in certain circumstances; 
• The right to restrict or object to the processing of personal data – individuals have the right to block the processing of their personal data by the University in specific situations; 
• The right to personal data portability – the right to request provision of some elements of information in digital form in order to provide it to you or to other organisations; 
• The right to withdraw a consent previously given. 

In the first instance, please contact the above GDPR Focal Point if you would like to discuss any aspect of your rights in relation to your personal data, or exercise these rights. You should note that removal or deletion of personal data may render the University unable to perform the relevant function. 

Feedback, Concern and Complaint 

If you have any feedback, concern or complaint in relation to the processing of your personal data, please contact the above GDPR Focal Point. If you have a formal complaint, you may contact the Office of the Privacy Commissioner for Personal Data of Hong Kong and/or the relevant supervisory authority. The University reserves the right to update this privacy policy at any time. 

Last updated: July 2021